Image Credit: Shutterstock
Key Takeaways
- Project Eleven built a working zero-knowledge proof letting Bitcoin owners recover coins frozen under BIP-361 without exposing private keys.
- The method depends on Bitcoin’s hierarchical key derivation tree (BIP-32), which didn’t exist when Satoshi mined early coins.
- Satoshi’s roughly 1.1 million BTC, held in pre-2012 addresses, cannot use this recovery mechanism.
Quantum research firm Project Eleven says it has built a working proof system that would let Bitcoin owners reclaim coins frozen under a proposed quantum-defense plan, without exposing their private keys. The tool does not help the roughly 1.1 million BTC linked to Bitcoin’s pseudonymous creator, Satoshi Nakamoto.
The prototype directly addresses a gap in Bitcoin Improvement Proposal 361, a plan published in April by developer Jameson Lopp and five co-authors that would restrict spending from quantum-vulnerable addresses. BIP-361 remains a proposal and has not been adopted as a Bitcoin consensus rule.
The Problem BIP-361 Was Written to Solve
BIP-361 would block new deposits to vulnerable Bitcoin addresses after three years and freeze whatever remains in them after five years. More than 34% of all Bitcoin sits in that category, according to the proposal, including Satoshi’s holdings.
The concern centers on a theoretical point researchers call Q-Day, when a sufficiently advanced quantum computer could derive a private key from a public key. Bitcoin’s signature scheme relies on elliptic curve cryptography, in which a private key generates a public key through math that runs in one direction only. Shor’s algorithm, a quantum method published in 1994, can reverse that math when fed a public key, handing an attacker the private key that created it. Once that happens, a valid signature no longer proves ownership, since an attacker could produce one as easily as the legitimate holder.
BIP-361’s proposed freeze always carried a limitation: locking coins conflicts with Bitcoin’s design promise of permanent, unconditional ownership. The proposal included a planned recovery mechanism using zero-knowledge proofs, a cryptographic method that lets one party prove it holds certain information without revealing that information. Project Eleven says it has now built and benchmarked that mechanism.
Why Hashing Survives Quantum Attacks Where Signatures Don’t
The proof relies on a separate area of cryptography that quantum computers cannot break as thoroughly. Hashing scrambles an input into a fixed-length output and cannot be reversed. The best known quantum attack against it, Grover’s algorithm, only halves the exponent involved rather than collapsing the problem entirely, cutting a 256-bit hash from 2^256 possible guesses to 2^128. That remains far beyond what any computer could exhaust within the lifetime of the universe.
Modern Bitcoin wallets are built on this hashing structure. A wallet generates a tree of keys, deriving each child key from its parent through a one-way hashing process. An attacker who breaks a single address after Q-Day gains only the key tied to that address and cannot reconstruct the parent key above it in the tree.
How the Proof Works
Project Eleven, working with Jim Posen, lead developer of the Binius proof system, built a zero-knowledge proof around that structure. A user proves they know the key material sitting above their address in the wallet’s derivation tree and that the material derives the address in question. The proof also binds to a specific transaction, without revealing any of the underlying key material.
According to benchmarks the company disclosed, generating the proof on an Apple M5 MacBook Air takes 243 milliseconds using four processor cores, with verification taking 40 milliseconds. The process uses about 2 gigabytes of memory, requires no graphics processing unit, and needs no trusted setup phase. Project Eleven said its system runs 16 times faster than prior work when including one-time setup costs, and roughly 60 times faster when that setup is excluded.
Why Satoshi’s Coins Are Excluded
The recovery method depends entirely on a hierarchical key structure that did not exist when Satoshi mined Bitcoin. That tree structure, defined in BIP-32, was assigned on February 11, 2012. Satoshi mined through 2009 and 2010 and appears to have stopped participating by 2011, before the standard existed.
Satoshi’s coins sit in pay-to-public-key outputs, with the public key written directly onto the blockchain, generated by early software that had no seed phrase, no derivation path, and no parent key. There is no key above them in a tree, because the tree concept had not yet been created. The same limitation applies to other pre-2012 wallets, a group that includes a meaningful share of Bitcoin’s oldest and most dormant holdings, the population BIP-361 was primarily written to address.
What Comes Next
Project Eleven has acknowledged the prototype remains unaudited. It currently supports three Bitcoin address types rather than the more recent Taproot format, roots its proof at the coin-type key rather than a wallet’s seed, and has not recovered any coins on Bitcoin’s live network.
The working prototype introduces a functioning recovery mechanism into the debate around BIP-361. Lopp has said he does not support the proposal on its own merits and wrote it because he views the alternative as worse. Critics of the plan have argued that freezing coins undermines Bitcoin’s core promise of permanent ownership.
Critics who argue that a freeze undermines permanent ownership have generally assumed the freeze would be irreversible for legitimate owners. Project Eleven’s proof would let a wallet holder with an intact seed phrase unlock frozen coins rather than lose them permanently. Satoshi’s coins predate the key structure the proof depends on, so they would not qualify.
